A version of this question comes up regularly, and I'd rather answer it directly than let a clean scan result get over-interpreted: what does the free scan actually look at, and where does its coverage stop?
What it checks
- Whether a real, live API key or secret, for Supabase, OpenAI, Stripe, AWS, and similar services, is sitting somewhere a browser can read it.
- Whether basic security headers are in place: HSTS, a Content-Security-Policy, clickjacking protection, and a handful of related settings.
- Whether your .env file, .git folder, or a similar configuration file is sitting publicly downloadable at a predictable address.
- Whether your CORS settings are wide open to any site, or your cookies are missing basic safety flags.
- Whether your server is disclosing more about itself, its version, its stack, than it needs to.
What it doesn't check
It doesn't log into your app, so it can't verify whether one logged-in user can reach another user's data by changing an ID. It doesn't know your specific business logic, so it can't tell you whether a discount code or a permission check works the way you intended. And it doesn't verify your database's access rules directly, since that requires credentials the scan is never given.
Why I'm being this specific about it
A scan that only checks what's visible from the outside, without logging in, is genuinely useful, and it's also a specific, bounded kind of useful. Overselling what a free, no-login scan can see would mean someone walks away thinking they're fully checked when the deeper, logged-in layer of their app was never actually looked at. I'd rather be precise about the boundary than let a clean result be mistaken for more than it is.
Where the deeper layer lives
That logged-in, business-logic layer, the ownership checks, the workflow-specific gaps, is exactly what the Deep Audit and Audit + Fix packages are built to cover, with someone actually testing your app the way a real user, or a real attacker, would. The free scan is the honest first pass. It was never meant to be the whole picture, and I'd rather tell you that directly than have you find out the hard way.
Related reading
- Q&A: My Free Scan Came Back Clean. Do I Still Need Anything Else?
- What Running Our Scanner on a Bunch of Real Live Apps This Week Actually Showed Me
- Myth: "My App Is Too Small to Be Worth Anyone Attacking"
Start with the free outside check, then see what a full audit covers.
See what's included